ccdeck 3.22.15 → 3.23.1

package/src/server/installer.mjs

@@ -5,13 +5,14 @@
 // sessions reach the same server through the rollout watcher instead, so one
 // running server still sees both CLIs. Re-runs are safe; entries are tagged
 // with __agent-dag and de-duped.
-import { readFile, mkdir, unlink, rename, open, stat, chmod, realpath, readlink } from "node:fs/promises";
+import { readFile, mkdir, unlink, rename, open, stat, chmod, realpath, readlink, utimes } from "node:fs/promises";
 import { existsSync } from "node:fs";
 import { join, resolve, dirname } from "node:path";
 import { setTimeout as delay } from "node:timers/promises";
 import { fileURLToPath } from "node:url";
 import { claudeConfigDir } from "./claude-dir.mjs";
 import { CODEX_HOME } from "./codex-dir.mjs";
+import { canonicalLogPath } from "./log-writer.mjs";
 import { shellQuoteArg } from "./exec.mjs";
 import { PRODUCT } from "./brand.mjs";
 
@@ -416,10 +417,31 @@ async function installHookScript(installDir) {
   return dst;
 }
 
+/**
+ * The entry Claude Code and Codex run, and the one number in it that is a
+ * promise about time.
+ *
+ * `timeout` is in SECONDS and it is a kill: when it expires the host CLI takes
+ * the hook down where it stands, which on a PreToolUse means the deck is handed
+ * a truncated body and the user waits the whole of it before the tool call
+ * proceeds. So the declared value has to be strictly larger than the worst the
+ * hook can spend on itself, and it was not. hook.js caps itself at CAP_MS =
+ * 1900ms, that cap now runs from Node's start rather than from main()'s, and
+ * what is still outside it is only the `sh -c` fork/exec — but 1900 + a fork
+ * under load does not fit in 2000. Measured through the installed command
+ * shape with a deck that stops answering mid-run: 1.84s idle, 1.98-2.19s with
+ * the box loaded (#1018).
+ *
+ * 3 is a backstop, not a budget: the hook ends itself first in every case it
+ * can see, and this is what covers the ones it cannot — a payload large enough
+ * that parsing it starves the timer, or a filesystem thread that cannot be
+ * interrupted at all. hook-budget.test.ts pins this number against hook.js's
+ * own cap so raising one without the other fails.
+ */
 function buildHookEntry(command) {
   return {
     [MARK_KEY]: true,
-    hooks: [{ type: "command", command, timeout: 2 }],
+    hooks: [{ type: "command", command, timeout: 3 }],
   };
 }
 
@@ -667,6 +689,59 @@ export function hasCodexInstalled() {
   return existsSync(CODEX_DIR);
 }
 
+/**
+ * Whether an older deck's Codex forwarders are still in hooks.json, found
+ * without touching the file: `{ settingsPath, count }` when they are, null when
+ * they are not or when the file cannot be read.
+ *
+ * #253 stopped installing Codex hooks and #317 deleted the recipe, but a
+ * machine that ran a deck from before either still has up to nine marked
+ * entries in $CODEX_HOME/hooks.json, each pointing at a copy of the forwarder
+ * that is still on disk. Wherever Codex honours that file, every one of them
+ * posts to `/api/event` — which takes a post without a token — while the
+ * rollout watcher reads the same session off disk, so the session is ingested
+ * twice: both copies reach the event ring and events.jsonl, and only the ones
+ * that land inside the reducer's redelivery windows are folded on the card.
+ * uninstallHooks takes them out, and `--uninstall` is its only caller; nothing
+ * else ever looked (#983).
+ *
+ * READ ONLY, and that is the decision rather than an oversight. This runs on
+ * every boot, and a boot writes nothing under the Codex directory — bin/deck.js
+ * says so where it decides whether to watch Codex at all. The one retirement a
+ * boot does perform on another tool's file, the finish-sound hook above, rides
+ * on a write of Claude Code's settings.json that the boot was making anyway,
+ * and installHooks says that riding along is what makes it safe: one write,
+ * compared against the bytes just read, converging on every later boot. A sweep
+ * of hooks.json would have none of that. It would be the deck's first
+ * unasked-for write to a file it no longer manages, made on every machine that
+ * has Codex, to cure a condition only upgraded machines have. So this finds
+ * them, the banner names them with the command that removes them, and the user
+ * decides — the shape `--uninstall` already gives the LAN key: named, not
+ * removed, unless somebody asked.
+ *
+ * A file that cannot be read answers null rather than throwing. The boot must
+ * not die over a Codex file, and "your hooks are in there" said of a file
+ * nobody could parse would be a guess; `--uninstall` reports that case itself,
+ * out loud, when it is run.
+ */
+export async function leftoverCodexHooks() {
+  const settingsPath = PROVIDERS.codex.settingsPath;
+  let settings;
+  try {
+    ({ settings } = await readSettingsForWrite(settingsPath));
+  } catch {
+    return null;
+  }
+  const hooks = settings?.hooks;
+  if (!hooks || typeof hooks !== "object") return null;
+  let count = 0;
+  for (const group of Object.values(hooks)) {
+    if (!Array.isArray(group)) continue;
+    for (const g of group) if (isOurEntry(g)) count++;
+  }
+  return count > 0 ? { settingsPath, count } : null;
+}
+
 /**
  * The events log as the record spells it: an absolute path, or null when this
  * deck writes none. Shared by the writer and by ensureDiscovery's comparison,
@@ -676,6 +751,21 @@ function persistField(persist) {
   return typeof persist === "string" && persist !== "" ? persist : null;
 }
 
+/**
+ * The Codex tree as the record spells it: the canonical path of the CODEX_HOME
+ * this process reads, or null for a --no-codex deck, which reads none. Shared by
+ * the writer and by ensureDiscovery's comparison for the reason persistField
+ * is, and exported for a start's own shape in bin/deck.js — so a start asking
+ * "does the running deck read my tree" spells the tree exactly the way the
+ * record it compares against does. Worked out on every call rather than once at
+ * load: it is one realpath on a five-second heartbeat, and a tree that did not
+ * exist when the deck started — the first `codex login` creates it — is then
+ * named the way it is named once it does.
+ */
+export function codexHomeField(codex) {
+  return codex !== false ? canonicalLogPath(CODEX_DIR) : null;
+}
+
 // Every deck's token lives in this directory, and writeFileAtomic's temp file is
 // created beside its target with whatever the umask allows — 0644 on most
 // machines — so for the moment before the rename the token would sit in a
@@ -731,6 +821,23 @@ export async function writeDiscovery({ port, workspace, token, persist = null, c
     // than win it and record a rollout it is not even reading. See
     // writesCodexLog in src/server/log-writer.mjs.
     codex: codex !== false,
+    // And WHOSE rollouts. `codex: true` says this deck tails them and never said
+    // from where, while CODEX_HOME moves the whole tree — #375 was five modules
+    // disagreeing about where it points. Two decks sharing one events.jsonl can
+    // therefore be reading two different trees, and the election grouped them
+    // anyway, because an unscoped deck's workspace contains every cwd and this
+    // was the one field that could have told them apart. The lower-port deck won
+    // a rollout it had never opened, the deck reading it stood down, and the
+    // shared log recorded nothing of that session (#982).
+    //
+    // Canonical rather than as spelled, for the reason canonicalLogPath gives
+    // the log path above (#793): a symlinked ~/.codex, an 8.3-shortened
+    // USERPROFILE or /tmp against /private/tmp would otherwise put two decks
+    // reading one tree into two groups and elect them both — the duplicate the
+    // election exists to end. Only this published copy is canonicalised.
+    // codex-dir.mjs goes on reading and writing through the spelling the user
+    // chose, which it has to for a symlinked home (see codexHome() there).
+    codexHome: codexHomeField(codex),
     // Does this deck run Browser Watch? The watch elects a single writer among
     // the decks on a machine, and it elected on port alone — so an older ccdeck
     // that predates the feature won the election by having the lower port and
@@ -791,13 +898,17 @@ export function discoveryPath() {
  * the deck received zero events while looking perfectly healthy. Re-asserting
  * is cheap (one small read), so the deck checks rather than assumes.
  *
- * A file this process wrote is left alone, mode included. Anything else — no
- * file, unreadable, another pid, a stale port, token, events log, Codex or
- * Claude setting, or a version left by the deck this process replaced — is
- * replaced. Every field another deck decides by is compared, the
+ * A file this process wrote is left alone, mode and contents included — only its
+ * mtime moves, stamped on every check; see the note where it is. Anything else —
+ * no file, unreadable, another pid, a stale port, token, events log, Codex
+ * setting or Codex tree, Claude setting, or a version left by the deck this
+ * process replaced — is replaced. Every field another deck decides by is compared, the
  * log path included: leave one out and a record missing it would pass as ours
  * forever, which for the log path means no deck can tell which of them share a
- * file and they all write their own copy of every event again.
+ * file and they all write their own copy of every event again. The Codex tree
+ * is compared strictly for the same reason: a record from before the field
+ * existed has none, and `undefined` must read as "rewrite", never as a
+ * --no-codex deck's null.
  */
 export async function ensureDiscovery({ port, workspace, token, persist = null, codex = true, claude = true, version = "", parent = null }) {
   const file = discoveryPath();
@@ -810,9 +921,19 @@ export async function ensureDiscovery({ port, workspace, token, persist = null,
       && (d.token ?? "") === (token ?? "")
       && (d.persist ?? null) === persistField(persist)
       && d.codex === (codex !== false)
+      && d.codexHome === codexHomeField(codex)
       && d.claude === (claude !== false)
       && (d.version ?? "") === (typeof version === "string" ? version : "")
       && (d.parent ?? null) === (Number.isInteger(parent) ? parent : null)) {
+      // STAMPED, though nothing in it changed. The mtime is how a reader tells a
+      // record some deck is still keeping from one whose deck is gone while its
+      // pid lives on under another process: hook.js unlinks a record whose port
+      // lets both challenge deadlines pass only once this stamp is a minute old
+      // (#1069), which a deck running this check every five seconds never lets
+      // happen. Best-effort — a stamp that cannot be written leaves the record
+      // exactly as every deck before this one left it.
+      const now = new Date();
+      await utimes(file, now, now).catch(() => {});
       return { file, rewritten: false };
     }
   } catch { /* missing, unreadable or corrupt — rewritten below */ }
@@ -909,4 +1030,11 @@ export { AGENT_DAG_DIR, CLAUDE_DIR, CODEX_DIR };
 // repo for the same reasons settings.json is, and "never rename onto a link" is
 // one rule: codex-auth.mjs called a realpath of its own before this existed, and
 // two spellings of a rule are two things that can drift.
-export { readSettingsForWrite, writeFileAtomic, renameWithRetry, createTemp, resolveWriteTarget };
+// `stripBom` goes out on the same argument at the smallest scale. Two stores
+// now move an unparseable file aside instead of writing defaults over it —
+// deck-prefs.mjs since #1002 and browser-watch-store.mjs since #1003 — and all
+// three readers have to mean the same thing by "a BOM is not damage". If they
+// do not, a prefs.json or a state.json somebody opened in Notepad gets
+// quarantined for a mark settings.json has ignored since this function was
+// written.
+export { readSettingsForWrite, writeFileAtomic, renameWithRetry, createTemp, resolveWriteTarget, stripBom };

package/src/server/lan-about.mjs

@@ -7,8 +7,10 @@
 // first thing somebody hunting for a known-broken version would want, and
 // nobody on the network is owed it. It rides the manifest exchange, which only
 // happens between two decks that have each accepted the other — and it is
-// sealed with that connection's key, because the frames around it are JSON in
-// the clear on the wire.
+// sealed with that connection's key on its own. Between two decks that both
+// seal (#810) the frame around it is sealed too, and this is a second seal
+// inside the first; toward a deck from before that, the frames around it are
+// still JSON in the clear on the wire, and this seal is the only one there is.
 //
 // BOTH WAYS. The deck that dials sends its own card with the question, and the
 // deck that answers sends its own with the answer. A deck that only calls in —
@@ -85,7 +87,10 @@ export function aboutThisDeck({
  *  `\p{Cc}` is the Unicode class for exactly those, C0 and C1 both. */
 function field(v, max, shape = null) {
   if (typeof v !== "string") return null;
-  const flat = v.replace(/\p{Cc}/gu, " ").replace(/\s+/g, " ").trim();
+  // `\p{Cf}` too — the FORMAT class the control class does not cover, holding
+  // U+202E and the directional isolates. `os` is free-form and 48 characters
+  // wide, so it is the longest peer-chosen string the panel draws.
+  const flat = v.replace(/\p{Cc}/gu, " ").replace(/\p{Cf}/gu, "").replace(/\s+/g, " ").trim();
   const s = [...flat].slice(0, max).join("").trim();
   return s && (!shape || shape.test(s)) ? s : null;
 }